3

On my server (over which I have little control), directories are listed by default, so for mysite.com/images I get:

Index of /images

Parent Directory
BirdsAreHere.png
CanYouSpot-AdBlank.jpg

etc. Is putting an index.html in that directory enough to prevent people listing the files, or is there still a way of getting at that list? Is it the same for my web root directory (mysite.com)?

2 Answers 2

4

Putting an index.html file should solve that problem. But if you really want to be sure no one gets the directory list just place an .htaccess file in the root of your www directory with this line in it:

Options -Indexes

That will prevent Apache from listing the files of your directories.

1

Is putting an index.html in that directory enough to prevent people listing the files, or is there still a way of getting at that list?

To clarify...

  • The directory listing is generated by mod_autoindex when Options +Indexes is set.

  • index.html is the default DirectoryIndex document. It is when a DirectoryIndex document does not exist in the requested directory that mod_autoindex generates a directory listing of that directory (served with a 200 OK response).

  • Options +Indexes was enabled by default on Apache 2.2. On Apache 2.4 it is not, however, many shared hosts do explicitly enable this in the server config.

There are a couple of edge cases that can allow the directory listing to still be generated:

  1. If you change the DirectoryIndex document(s) (eg. DirectoryIndex index.php in .htaccess or server config) then index.html is no longer a DirectoryIndex document, so a directory listing will be generated.

  2. If you disable directory slashes (ie. DirectorySlash Off) to prevent slashes being appended to physical directories (sometimes preferred for cosmetic reasons) then even if a DirectoryIndex document exists in that directory, when you request the directory without a trailing slash, a directory listing will be generated. The Apache docs specifically warn about this behaviour.

    So if you set DirectorySlash Off then you must also disable mod_autoindex directory listings with Options -Indexes, if this behaviour is not desirable.

Placing a minimal index.html document in a directory to prevent directory listings is really just a messy workaround for when you don't have access to set Options -Indexes (as mentioned in the other answer) for that directory. Not only would you need to place a index.html document in every directory, this also returns a 200 OK response which is less than ideal.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.